chore(deps): update dependency electron to v42 [security] by renovate-ce-paramount-engineering[bot] · Pull Request #87 · paramount-engineering/roku-dev-studio

renovate-ce-paramount-engineering · 2026-10-31T10:02:15Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
electron	`39.8.10` → `42.11.9`

Electron: openExternal permission requests can be attributed to the wrong origin

CVE-2026-114121 / GHSA-997q-gvvc-jwmx

More information

Details

Impact

Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requestingUrl passed to session.setPermissionRequestHandler was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application.

Apps are only affected if they grant openExternal based on the requesting origin and let untrusted content open or navigate windows. Apps whose permission handler denies openExternal for untrusted content are not affected.

Workarounds

Deny the openExternal permission for untrusted content, or deny the windows it opens with setWindowOpenHandler.

Fixed Versions

45.0.0-alpha.5
44.3.0
43.7.0
42.11.3

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

CVSS Score: 5.4 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

CVE-2026-114124 / GHSA-h3v5-h239-pg29

More information

Details

Impact

In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. GHSA-pfmc-3mgc-p6fp covers the same issue on the other capture paths.

Apps are only affected if they use offscreen rendering (webPreferences.offscreen) on macOS and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

45.0.0-alpha.9
44.4.3
43.7.3
42.11.6

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

CVSS Score: 3.9 / 10 (Low)
Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Frame subscription trusts GPU-supplied frame geometry

CVE-2026-114122 / GHSA-3qxv-5xgr-q7w9

More information

Details

Impact

Frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing the captured frame images, disclosing memory or crashing the app.

Apps are only affected if they use webContents.beginFrameSubscription and an attacker has separately gained code execution in the GPU process. Apps that do not subscribe to captured frames are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

45.0.0-alpha.9
44.4.3
43.7.3
42.11.6

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

CVSS Score: 3.9 / 10 (Low)
Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

CVE-2026-113797 / GHSA-98mx-cjp9-gchm

More information

Details

Impact

chrome.tabs.query() returned each tab's url and title to extensions that held neither the tabs permission nor matching host permissions, so any loaded extension could read the URL and title of every webContents in its session.

Apps are only affected if they load extensions (session.extensions.loadExtension) that they do not fully trust. Apps that load no extensions, or only trusted ones, are not affected.

Workarounds

Do not load untrusted or unvalidated extensions. In general you should only load trusted extensions.

Fixed Versions

45.0.0-alpha.4
44.1.1
43.5.1
42.11.1

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

CVSS Score: 3.1 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: SameSite cookie restrictions are not applied to windows opened from links

CVE-2026-113796 / GHSA-2p8c-gr87-2676

More information

Details

Impact

Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: SameSite=Strict cookies were sent and Sec-Fetch-Site did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence.

Apps are only affected if they load untrusted content and allow it to open new windows. Apps that deny new windows from untrusted content with setWindowOpenHandler are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for windows opened by untrusted content.

Fixed Versions

45.0.0-alpha.6
44.3.0
43.7.0
42.11.3

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

CVSS Score: 4.2 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Pointer lock permission requests can be attributed to the wrong frame

CVE-2026-113798 / GHSA-x562-297c-g43g

More information

Details

Impact

For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler() was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity.

Apps are only affected if they embed untrusted content in iframes and decide pointerLock requests by origin in setPermissionRequestHandler. Apps that do not embed untrusted content, or that deny pointerLock for it, are not affected.

Workarounds

Deny the pointerLock permission for web contents that embed untrusted frames.

Fixed Versions

45.0.0-alpha.13
44.5.0
43.7.6
42.11.9

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

CVSS Score: 5.4 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

electron/electron (electron)

`v42.11.9`: electron v42.11.9

Compare Source

Release Notes for v42.11.9

Fixes

Fixed clipboard.read(), readText() and has() resolving seconds late on Linux while the app was idle. #54310 ^{(Also in 43, 44, 45)}
Fixed fs.rmSync failing to remove read-only files on Windows. #54257 ^{(Also in 43, 44, 45)}
Fixed pointerLock permission requests from some iframes reporting the parent frame. #54466 ^{(Also in 43, 44, 45)}
Fixed utilityProcess dropping stdout/stderr output that the child wrote immediately before exiting. #54332 ^{(Also in 43, 44, 45)}
Fixed WebAssembly exception handlers failing to catch, or crashing during tier-up, in modules using wasm exceptions. #54236
Fixed WebAssembly modules loaded from the code cache crashing or throwing RuntimeError: unreachable after updating between certain patch releases. #54239 ^{(Also in 43, 44, 45)}

`v42.11.8`: electron v42.11.8

Compare Source

Release Notes for v42.11.8

Other Changes

Backported fixes from upstream ANGLE, Chromium, Dawn, PDFium and V8. #54223

`v42.11.7`: electron v42.11.7

Compare Source

Release Notes for v42.11.7

Fixes

Fixed a spurious "sandboxed_renderer.bundle.js script failed to run" console error when DevTools attached to a sandboxed frame before its first navigation. #54175 ^{(Also in 43)}
Fixed an "Invalid guestInstanceId" error when removing a loaded <webview> from the DOM. #54098 ^{(Also in 43, 44, 45)}

`v42.11.6`: electron v42.11.6

Compare Source

Release Notes for v42.11.6

Other Changes

Backported fixes from upstream Chromium, Dawn, PDFium, Skia and V8. #54083

`v42.11.5`: electron v42.11.5

Compare Source

Release Notes for v42.11.5

Other Changes

Backported fixes from upstream ANGLE, Chromium, Skia and V8. #53986

`v42.11.4`: electron v42.11.4

Compare Source

Release Notes for v42.11.4

Fixes

Fixed a renderer crash when an iframe was removed right after loading with nodeIntegrationInSubFrames enabled and sandbox disabled, e.g. on pages that embed Meta Pixel. #53886 ^{(Also in 43, 44, 45)}

Other Changes

Backported fixes from upstream ANGLE, Chromium, libyuv, PDFium and V8. #53767

`v42.11.3`: electron v42.11.3

Compare Source

Release Notes for v42.11.3

Fixes

File System Access permission requests and the file-system-access-restricted event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. #53695 ^{(Also in 43, 44, 45)}
Fixed session.setPermissionCheckHandler receiving the top-level origin and a null webContents for hid and usb checks made from a subframe. #53736 ^{(Also in 43, 44, 45)}
Fixed webContents.on(), removeListener() and removeAllListeners() throwing "Object has been destroyed" for console-message listeners after the WebContents was destroyed. #53497 ^{(Also in 43, 44, 45)}
Fixed a crash on Linux when process.env was written while another thread was reading the environment, and a memory leak when a worker thread exits. #53511 ^{(Also in 43, 44, 45)}
Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. #53585 ^{(Also in 43, 44, 45)}
Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process window.open() child whose contextIsolation differed from its opener's. #53541 ^{(Also in 43, 44, 45)}
Fixed crashes in setDisplayMediaRequestHandler when the granted frame had been destroyed or another tab was granted by id. #53674 ^{(Also in 43, 44, 45)}
Internal <webview>, window.close() and executeJavaScript reply IPCs are validated against the sending frame. #53727 ^{(Also in 43, 44, 45)}
<webview> without allowpopups also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. #53719 ^{(Also in 43, 44, 45)}
getUserMedia with chromeMediaSource: 'desktop' no longer accepts WebContents source ids; use chromeMediaSource: 'tab' with webContents.getMediaSourceId() or setDisplayMediaRequestHandler to capture a WebContents. #53710 ^{(Also in 43, 44, 45)}
nodeIntegrationInWorker now applies only to workers created by frames that themselves have Node integration; enable nodeIntegrationInSubFrames to keep Node in workers created by subframes. #53713 ^{(Also in 43, 44, 45)}
openExternal permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. #53697 ^{(Also in 43, 44, 45)}
pointerLock and keyboardLock permission requests now report the requesting frame, and execCommand('paste') requires user activation in the frame that calls it. #53702 ^{(Also in 43, 44, 45)}

`v42.11.2`: electron v42.11.2

Compare Source

Release Notes for v42.11.2

Fixes

Fixed application crash after a large number of IPC messages from renderers. #53419 ^{(Also in 43, 44, 45)}
Fixed native addons deriving from node::ObjectWrap aborting during garbage collection on Node.js 24.19.0 and later. #53394 ^{(Also in 43, 44, 45)}

Other Changes

Backported fixes from upstream ANGLE, Chromium, Skia and V8. #53480
Backported fixes from upstream Chromium, Dawn, Skia and V8. #53397
Backported fixes from upstream Chromium, V8, ANGLE, Dawn, Skia, WebRTC and DevTools. #53367

`v42.11.1`: electron v42.11.1

Compare Source

Release Notes for v42.11.1

Fixes

Fixed chrome.tabs.query() returning tab url and title to extensions without the tabs permission or host access, aligning with tabs.get. #53355 ^{(Also in 43, 44, 45)}
Fixed a renderer crash when an array with a throwing property getter is passed across contextBridge, and several main/utility-process crashes when option objects passed to Electron APIs contain throwing accessors or Proxy traps. #53329 ^{(Also in 43, 44)}

Other Changes

Security: backported fixes for CVE-2026-15764, CVE-2026-15765, CVE-2026-15766, CVE-2026-15767, CVE-2026-15768, CVE-2026-15769, CVE-2026-15770, CVE-2026-15771, CVE-2026-15772, CVE-2026-15773, CVE-2026-15774, CVE-2026-15775, CVE-2026-15776, CVE-2026-15777, CVE-2026-15778. #53344

`v42.11.0`: electron v42.11.0

Compare Source

Release Notes for v42.11.0

Fixes

Fixed fs.constants.O_DIRECTORY, O_NOFOLLOW and O_DIRECT holding x86 values on Linux arm64 and armv7l, which made opening a directory fail with EINVAL, and made require('trace_events') behave the same on cross-compiled builds as on native ones. #53318 ^{(Also in 43, 44, 45)}
Fixed a crash when calling node:wasi functions in optimized code. #53267 ^{(Also in 43, 44, 45)}
Fixed a regression where a window created with a custom title can show an empty title after using back/forward navigation. #53217 ^{(Also in 43, 44)}
Fixed desktopCapturer thumbnail generation and premature portal timeout on Linux with Wayland. #51784 ^{(Also in 43)}
Fixed region-qualified --lang values such as de-DE loading no locale resources on macOS, which left localized strings empty and could crash WebAuthn Touch ID prompts. #53187 ^{(Also in 43, 44)}
Fixed the GPU process being terminated in AppX/MSIX packaged apps on Windows when WebGPU fell back to SwiftShader. #53199 ^{(Also in 43, 44)}

Other Changes

Backported fixes from upstream ANGLE, Chromium, Dawn, V8 and WebRTC. #53191
Updated Node.js to v24.19.0. #52634

`v42.10.1`: electron v42.10.1

Compare Source

Release Notes for v42.10.1

Fixes

Fixed webContents.print() honoring printBackground, duplexMode, and printer default duplex settings. #53158 ^{(Also in 43, 44)}
Fixed a crash on macOS when a notification's icon could not be attached; the notification is now shown without the icon. #53148 ^{(Also in 43, 44)}
Fixed an issue where pages loaded in a detached WebContentsView wouldn't see the correct window size. #53151 ^{(Also in 43, 44)}
Fixed the primary instance being killed or receiving truncated arguments when a second instance passed a very long command line or large additionalData to app.requestSingleInstanceLock(). #53157 ^{(Also in 43, 44)}

Other Changes

Backported fixes from upstream ANGLE, Chromium, Dawn, Skia and V8. #52970
Page resources, fetch() calls and file:// loads in renderers no longer wait for the main process to be idle when no webRequest listeners or protocol interceptors are registered. #53143 ^{(Also in 43, 44)}

`v42.10.0`: electron v42.10.0

Compare Source

Release Notes for v42.10.0

Features

Fixed contentTracing module to capture Node.js trace categories. #52973

Fixes

Fixed DevTools device metrics overrides persisting indefinitely when a remote debugging client disconnected without clearing them. #53133 ^{(Also in 43, 44)}
Fixed DevTools popup and context menus not appearing when DevTools is hosted in a custom window via webContents.setDevToolsWebContents(). #52981 ^{(Also in 43, 44)}
Fixed BrowserWindow.unmaximize() and restore() having no effect on Wayland when the window was maximized immediately after creation. #53126 ^{(Also in 44)}
Fixed Uncaught illegal access errors and possible renderer crashes after closing a same-process child window or removing an iframe with nodeIntegrationInSubFrames enabled. #53042 ^{(Also in 44)}
Fixed dialog.showOpenDialog/dialog.showSaveDialog opening at an unusable location on Linux when defaultPath is a bare filename without a directory. #52980 ^{(Also in 43, 44)}
Fixed a crash on Linux when the D-Bus session bus disconnected while the app was running, such as at logout or when dbus is restarted. #53094 ^{(Also in 43, 44)}
Fixed a crash on Windows when V8 posted a delayed worker task during shutdown. #53014 ^{(Also in 43)}
Fixed a crash with app.setLoginItemSettings if a non-UTF8 service name is used. #52989 ^{(Also in 43, 44)}
Fixed a possible crash (SIGABRT) during process exit when the process had loaded tls/https shortly before exiting, affecting app.exit() before ready and short-lived ELECTRON_RUN_AS_NODE / child_process.fork() scripts. #52992 ^{(Also in 43, 44)}
Fixed a possible main process crash at quit when a session was created from JavaScript that runs during shutdown. #53132 ^{(Also in 43, 44)}
Fixed a rare crash in the main process when DevTools were opened and a garbage collection ran before the DevTools frontend finished loading. #52994 ^{(Also in 43, 44)}
Fixed a renderer crash when a page calls SpeechRecognition.available() or SpeechRecognition.install() with processLocally. #53016 ^{(Also in 43, 44)}
Fixed an issue on Linux where the system theme color appeared at the top edge of frameless windows. #52978 ^{(Also in 41, 43)}
Fixed an issue where some values passed into requestSingleInstanceLock could result in a crash. #52982 ^{(Also in 43, 44)}
Fixed crash in sharedTexture module when GPU context becomes unavailable. #52983 ^{(Also in 43, 44)}
Fixed document title updates when using back/forward navigation using the same document without utilizing browserWindow.setTitle(). #53099 ^{(Also in 43, 44)}
Fixed the built-in PDF viewer not rendering documents in in-memory sessions (partitions without the persist: prefix). #52990 ^{(Also in 43, 44)}
Fixed titleBarOverlay.color set to rgba(0,0,0,0) failing back to default frame color. #52976 ^{(Also in 41, 43)}
Fixed utility process crashes at exit on Windows 11 24H2 and later. #53091 ^{(Also in 43, 44)}

Other Changes

Backported fixes from upstream Chromium and V8. #53060
Fixed a 1-in-200 chance per renderer process on Windows of scripts on the first page load being compiled without their V8 code cache. #52988 ^{(Also in 43, 44)}
Fixed a Windows x64 renderer performance regression introduced in 42.8.1 that made style/layout work (and app startup) noticeably slower. #53064
Fixed a stall of tens of milliseconds while creating the first BrowserWindow on Linux.
- Improved the performance of file lookups inside ASAR archives and of large files served from them to the renderer.
- Improved the performance of calls through contextBridge-exposed APIs.
- Reduced the main-thread cost of sending large values through ipcRenderer, ipcMain handlers and webContents.send. #53019 ^{(Also in 43, 44)}
Improved startup time of utilityProcess.fork(), child_process.fork() / ELECTRON_RUN_AS_NODE child processes and Node.js-enabled renderers. #53136 ^{(Also in 43, 44)}
Linux arm64, Windows arm64 and macOS x64 builds now start the main process from the embedded Node.js startup snapshot like the other platforms, improving startup time. #52880 ^{(Also in 43, 44)}

`v42.9.3`: electron v42.9.3

Compare Source

Release Notes for v42.9.3

Fixes

Fixed a graphical glitch on Linux where thin borders appeared past the drop shadows on frameless windows when multiple windows were created. #52772 ^{(Also in 43, 44)}
Fixed a memory leak when creating BrowserWindows. #52893 ^{(Also in 43, 44)}
Fixed an issue on Windows where the app process could fail to exit after app.quit() while a shell.openExternal() or shell.openPath() call was still waiting on a system "Open with" dialog. #52900 ^{(Also in 41, 43, 44)}
Fixed custom V8 snapshots (electron-mksnapshot, and the loadBrowserProcessSpecificV8Snapshot fuse) having no effect in the main process on macOS arm64, Linux x64 and Windows x64. #52876 ^{(Also in 43, 44)}

Other Changes

Backported fix for 5246282. #52869
Reduced idle main-process CPU wakeups caused by Node.js timers and immediates. #52907 ^{(Also in 43, 44)}

`v42.9.2`: electron v42.9.2

Compare Source

Release Notes for v42.9.2

Fixes

Fixed registerFileProtocol and registerHttpProtocol returning readable responses to cross-origin no-cors fetches; they now return opaque responses like protocol.handle. #52855 ^{(Also in 41, 43, 44)}
Fixed a WebContentsView staying blank after its window is shown when setBackgroundThrottling(false) was called while the window was hidden. #52865 ^{(Also in 43, 44)}
Fixed a crash when resolving a path inside a malformed ASAR archive that contains cyclic link entries. #52859 ^{(Also in 43, 44)}
Fixed downloading files that live inside an asar archive, including saving a packed PDF from the built-in PDF viewer. #52828 ^{(Also in 43, 44)}
Fixed windows opened by a sandboxed top-level frame not inheriting the opener's sandbox restrictions. #52850 ^{(Also in 41, 43, 44)}
<webview> and window.open now inherit nodeIntegrationInWorker from the embedder, consistent with the other Node and sandbox preferences. #52831 ^{(Also in 41, 43, 44)}

Other Changes

Backported fixes for 5422242, 5420251. #52843

`v42.9.1`: electron v4

[!IMPORTANT]
✂ PR body was truncated to here.

chore(deps): update dependency electron to v42 [security]

02c7272

renovate-ce-paramount-engineering Bot added the security label Oct 31, 2026

Navigation Menu

Repository navigation

chore(deps): update dependency electron to v42 [security] - #87

chore(deps): update dependency electron to v42 [security]#87
renovate-ce-paramount-engineering[bot] wants to merge 1 commit into
mainfrom
renovate/npm-electron-vulnerability

renovate-ce-paramount-engineering Bot commented Oct 31, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Conversation

renovate-ce-paramount-engineering Bot commented Oct 31, 2026

Electron: openExternal permission requests can be attributed to the wrong origin

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: Frame subscription trusts GPU-supplied frame geometry

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: SameSite cookie restrictions are not applied to windows opened from links

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: Pointer lock permission requests can be attributed to the wrong frame

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Release Notes

v42.11.9: electron v42.11.9

Release Notes for v42.11.9

Fixes

v42.11.8: electron v42.11.8

Release Notes for v42.11.8

Other Changes

v42.11.7: electron v42.11.7

Release Notes for v42.11.7

Fixes

v42.11.6: electron v42.11.6

Release Notes for v42.11.6

Other Changes

v42.11.5: electron v42.11.5

Release Notes for v42.11.5

Other Changes

v42.11.4: electron v42.11.4

Release Notes for v42.11.4

Fixes

Other Changes

v42.11.3: electron v42.11.3

Release Notes for v42.11.3

Fixes

v42.11.2: electron v42.11.2

Release Notes for v42.11.2

Fixes

Other Changes

v42.11.1: electron v42.11.1

Release Notes for v42.11.1

Fixes

`v42.11.9`: electron v42.11.9

`v42.11.8`: electron v42.11.8

`v42.11.7`: electron v42.11.7

`v42.11.6`: electron v42.11.6

`v42.11.5`: electron v42.11.5

`v42.11.4`: electron v42.11.4

`v42.11.3`: electron v42.11.3

`v42.11.2`: electron v42.11.2

`v42.11.1`: electron v42.11.1

`v42.11.0`: electron v42.11.0

`v42.10.1`: electron v42.10.1

`v42.10.0`: electron v42.10.0

`v42.9.3`: electron v42.9.3

`v42.9.2`: electron v42.9.2

`v42.9.1`: electron v4